ALSA-2022:9058 Important: prometheus-jmx-exporter security update

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security Fixes: SnakeYaml: Constructor Deserialization Remote Code Execution CVE-2022-1471 For more details about the security issues, including the impact, a...

GHSA-MJMJ-J48Q-9WG2 SnakeYaml Constructor Deserialization Remote Code Execution

Summary SnakeYaml's Constructor class, which inherits from SafeConstructor, allows any type be deserialized given the following line: new Yamlnew ConstructorTestDataClass.class.loadyamlContent; Types do not have to match the types of properties in the target class. A ConstructorException is throw...

CVE-2022-1471 vulnerabilities

Vulnerabilities for packages: metric-collector-for-apache-cassandra-4.1, management-api-for-apache-cassandra-5.0, cassandra-reaper...

CVE-2022-1471 vulnerabilities

Vulnerabilities for packages: metric-collector-for-apache-cassandra-4.0, s3proxy, s3proxy-fips, cassandra-reaper, metric-collector-for-apache-cassandra-4.1, management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1, management-api-for-apache-cassandra-4.0...

DEBIAN-CVE-2022-1471

SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. ...

CVE-2022-1471

SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. ...

CVE-2022-1471

CVE-2022-1471 is caused by SnakeYAML deserialization allowing remote code execution. At Atlassian Data Center/Server products (e.g., Jira Core/Jira Software/Data Center and Server, Confluence Data Center/Server, Bitbucket Data Center/Server) multiple versions were affected due to the SnakeYAML un...

CVE-2022-1471

creationtimestamp| type| source ---|---|--- 2022-10-13 17:30:29+00:00| published-proof-of-concept| https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2 2022-12-01 14:30:28+00:00| seen| https://t.me/cibsecurity/53754 2023-10-09 21:14:14+00:00| seen|...

CVE-2020-1471

creationtimestamp| type| source ---|---|--- 2022-05-27 14:19:42+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/1720...

SUSE: Security Advisory (SUSE-SU-2021:1471-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-1471

creationtimestamp| type| source ---|---|--- 2021-03-26 20:59:07+00:00| published-proof-of-concept| Telegram/Vj4bMA2ip6jgb8s74wUmEnJxkWt3bGPeSB4IVr8kxdqiA...

Critical Cisco Jabber Bug Could Let Attackers Hack Remote Systems

Cisco on Wednesday released software updates to address multiple vulnerabilities affecting its Jabber messaging clients across Windows, macOS, Android, and iOS. Successful exploitation of the flaws could permit an "attacker to execute arbitrary programs on the underlying operating system with...

CVE-2021-1471 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities

Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic,...

KLA12132 Multiple vulnerabilities in Cisco Jabber

Multiple vulnerabilities were found in Cisco Jabber. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A code execution vulnerability in Cisco Jabber for Windows can b...

Amazon Linux AMI : golang (ALAS-2021-1471)

The version of golang installed on the remote host is prior to 1.15.5-1.65. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1471 advisory. Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 Go before 1.14.12 and 1.15.x before...

Amazon Linux AMI : golang (ALAS-2020-1471) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1471 advisory. - Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 - Go before 1.14.12 and...

CVE-2020-1471 Windows CloudExperienceHost Elevation of Privilege Vulnerability

...

CVE-2020-1471

CVE-2020-1471 is an elevation-of-privilege vulnerability in Windows CloudExperienceHost. The root cause, as described in the initial document, is that CloudExperienceHost fails to properly check COM objects, enabling an attacker who can log on to an affected system to run a crafted script or appl...

KB4577041: Windows 10 Version 1709 September 2020 Security Update

The remote Windows host is missing security update 4577041. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary co...

KB4574727: Windows 10 Version 1903 and Windows 10 Version 1909 September 2020 Security Update

The remote Windows host is missing security update 4574727. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary co...